i18next-http-backend incomplete URL validation permits SSRF

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolat...

EUVD-2026-93416

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.translation.getsupportedlanguagevariant is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory...

CVE-2026-77050

A potential denial-of-service (DoS) vulnerability exists in the Django web framework within the django.utils.translation.get_supported_language_variant() function. The issue is caused by the application processing numerous distinct and very long language codes, which are stored as keys in an in-m...

CVE-2026-77050 Potential denial-of-service vulnerability in get_supported_language_variant()

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.translation.getsupportedlanguagevariant is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory...

CLEANSTART-2026-UP81071 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

Secure Speculative Decoding for Large Language Models

Speculative decoding accelerates inference for a large language model LLM, referred to as the target model, by first using a smaller model, referred to as the draft model, to generate candidate tokens and then verifying them with the target model for acceptance or rejection. Prior studies primari...

Linux Distros Unpatched Vulnerability : CVE-2026-104711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the...

The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models

Safety alignment in Large Language Models LLMs remains vulnerable to backdoor attacks. Existing LLM backdoors are almost all input-centric: activation depends on explicit trigger patterns in the user input, so modern guardrails are built to sanitize the input space. We challenge this assumption...

Security Bulletin: Due to the use of Spring Expression Language (SpEL), IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-47886)

Summary Spring Expression Language SpEL is used by IBM Sterling Control Center as part of dependency in spring-expression-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47886 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a...

CVE-2026-104711

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

EUVD-2026-92622

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2026-104711

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

Astra Linux - Vulnerability in Golang-1.19

A malicious HTTP/2 client that quickly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is limited by the http2.Server.MaxConcurrentStreams setting, resetting an ongoing request allows the attacker to create a new...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

Astra Linux - Vulnerability in Golang-1.19

A denial of service may occur due to excessive resource consumption in the net/http and mime/multipart libraries. Parsing multipart forms using mime/multipart.Reader.ReadForm can consume a largely unlimited amount of memory and disk space. This issue also affects form parsing in the net/http...

Astra Linux – Vulnerability in Golang-1.15

In versions of Go prior to 1.15.13 and 1.16.x prior to 1.16.5, a crafted file count present in the archive’s header can lead to a panic in NewReader or OpenReader...

Astra Linux – Vulnerability in libxml2

A vulnerability was discovered in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to create a malicious XML input file that can cause libxml to crash, resulting in a denial of service or other undefined...

Astra Linux – Vulnerability in RustC

In the standard library of Rust before version 1.49.0, the String::retain function has a panic security issue. It allows the creation of a non-UTF-8 Rust string when the provided closure panics. This bug could lead to a memory safety violation if other string APIs assume that UTF-8 encoding is us...

Astra Linux – Vulnerability in Golang-1.23

The HTTP client discards sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header, which is redirected to b.com/, will not send that header to b.com. However, if the client receives a subsequent same-domain redirect, the...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the Media component of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code within a sandbox using a crafted HTML page. Chromium security severity: High...